[Paper Review] A new zero-knowledge code based identification scheme with reduced communication

Carlos Aguilar, Philippe Gaborit+1 more|arXiv (Cornell University)|Nov 7, 2011

Coding theory and cryptography3 references4 citations

TL;DR

This paper presents a new zero-knowledge identification scheme based on the syndrome decoding problem using double-circulant codes, achieving a 40% reduction in communication cost compared to prior code-based schemes. By introducing cyclic shift-based challenges and compressed hash commitments, it reduces authentication communication to 19 kb (for 2^16 security) and signatures to 93 kb (for 2^80 security), while maintaining small public and secret keys of a few hundred bits and a cheating probability near 1/2.

ABSTRACT

In this paper we present a new 5-pass identification scheme with asymptotic cheating probability 1/2 based on the syndrome decoding problem. Our protocol is related to the Stern identification scheme but has a reduced communication cost compared to previous code-based zero-knowledge schemes, moreover our scheme permits to obtain a very low size of public key and secret key. The contribution of this paper is twofold, first we propose a variation on the Stern authentication scheme which permits to decrease asymptotically the cheating probability to 1/2 rather than 2/3 (and very close to 1/2 in practice) but with less communication. Our solution is based on deriving new challenges from the secret key through cyclic shifts of the initial public key syndrome; a new proof of soundness for this case is given Secondly we propose a new way to deal with hashed commitments in zero-knowledge schemes based on Stern's scheme, so that in terms of communication, on the average, only one hash value is sent rather than two or three. Overall our new scheme has the good features of having a zero-knowledge security proof based on well known hard problem of coding theory, a small size of secret and public key (a few hundred bits), a small calculation complexity, for an overall communication cost of 19kb for authentication (for a $2^{16}$ security) and a signature of size of 93kb (11.5kB) (for security $2^{80}$), an improvement of 40% compared to previous schemes based on coding theory.

Motivation & Objective

• To reduce the communication cost of code-based zero-knowledge identification schemes, which previously exceeded 150 kb for 2^80 security.
• To lower the cheating probability to approximately 1/2, improving upon the 2/3 bound in standard Stern-like schemes.
• To maintain small public and secret key sizes (a few hundred bits) while ensuring security based on the well-studied syndrome decoding problem.
• To optimize commitment transmission by compressing multiple hash commitments into a single value on average.
• To enable practical deployment of code-based zero-knowledge protocols with reduced bandwidth and computational overhead.

Proposed method

• The protocol uses a 5-pass structure based on the Stern identification framework, with challenges derived from cyclic shifts of the secret key's syndrome to increase the number of valid challenges.
• A new soundness proof is provided for the modified challenge mechanism, showing that the cheating probability asymptotically approaches 1/2.
• A novel commitment compression technique is introduced, where only one hash value is transmitted on average instead of two or three, reducing communication overhead.
• The scheme leverages double-circulant matrices to compactly represent the public key, reducing its size to just a few hundred bits.
• The secret key is represented as a low-weight error vector of length n, with the syndrome derived from a structured generator matrix.
• The Fiat-Shamir transform is applied to convert the identification scheme into a signature scheme with a signature size of 93 kb for 2^80 security.

Experimental results

Research questions

• RQ1 Can the communication cost of code-based zero-knowledge identification schemes be reduced by more than 40% without compromising security or key size?
• RQ2 Is it possible to reduce the cheating probability from 2/3 to near 1/2 while maintaining zero-knowledge security and reducing communication?
• RQ3 Can the number of transmitted hash commitments be reduced from two or three to one on average, without weakening the protocol’s security?
• RQ4 How effective is the use of double-circulant matrices in minimizing public and secret key sizes while preserving hardness of the underlying syndrome decoding problem?
• RQ5 What is the practical communication and computational cost of the proposed scheme for real-world deployment at standard security levels (e.g., 2^80 and 2^128)?

Key findings

• The proposed scheme reduces communication cost by 40% compared to previous code-based zero-knowledge schemes, achieving 19 kb for authentication at 2^16 security.
• The signature size is reduced to 93 kb for a 2^80 security level, down from 155 kb in prior schemes.
• The public key size is reduced to 350 bits using double-circulant matrices, and the secret key to 700 bits, both significantly smaller than previous schemes.
• The cheating probability is reduced to approximately 1/2, with a practical probability of success for an adversary of 2^-16 for the identification scheme.
• The scheme achieves a prover computation cost of 2^21 operations in F2 for 2^16 security, and 2^16 multiplications in F256 for 2^80 signature security.
• Using constant-weight encoding for σ(e_r), the communication cost can be further reduced to 17 kb for authentication and 79 kb for signatures, though at the cost of increased complexity.